CVE-2020-3177CWE-22

Cisco Unified Communications Manager Path Traversal Vulnerability

High · published April 15, 2020

CVSS v3.0
7.5
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

A vulnerability in the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is due to insufficient validation of user-supplied input to the TAPS interface of the affected device. An attacker could exploit this vulnerability by sending a crafted request to the TAPS interface. A successful exploit could allow the attacker to read arbitrary files in the system.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02799 · 86.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2020-04-15T20:10Z
EPSS history
Timeline
  • 15 APR 20:10Z
    Cisco Unified Communications Manager Path Traversal Vulnerability
    cvelistv5